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To the President and Members of the Court 
WRITTEN OBSERVATIONS OF THE REPUBLIC OF AUSTRIA 


under Article 23 of the Protocol on the Statute 
of the Court of Justice of the European Union 

in 

CASE C-362/14 

The Republic of Austria comments as follows on the request for a preliminary 
ruling made by the High Court of Ireland in its decision of 17 July 2014: 


I - Questions referred 

1 The High Court of Ireland has referred the following questions to the court for an 
interpretation of EU law by way of a preliminary ruling: 

‘Whether in the course of determining a complaint which has been made to an 
independent office holder who has been vested by statute with the functions of 
administering and enforcing data protection legislation that personal data is being 
transferred to another third country (in this case, the United States of America) the 
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* Language of the case: English. 
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laws and practices of which, it is claimed, do not contain adequate protections for 
the data subject, that office holder is absolutely bound by the Community finding 
to the contrary contained in Commission Decision of 26 July 2000 (2000/520/EC) 
having regard to Article 7, Article 8 and Article 47 of the Charter of Fundamental 
Rights of the European Union (2000/C 364/011), the provisions of Article 25(6) 
of Directive 95/46/EC notwithstanding? Or, alternatively, may and/or must the 
office holder conduct his or her own investigation of the matter in the light of 
factual developments in the meantime since that Commission Decision was first 
published?’ 


II - Legal evaluation 


1. The binding effect of adequacy decisions under Article 25(6) on 
supervisory authorities within the meaning of Article 28 of Directive 
95/46/EC in general 

Directive 95/46/EC 1 (‘the Directive’) creates a specific legal framework for EU 
Member States for the transfer of personal data to third countries. Under 
Article 25 of the Directive the Member States are to provide that ‘that the transfer 
to a third country of personal data which are undergoing processing or are 
intended for processing after transfer may take place only if . . . the third country in 
question ensures an adequate level of protection’ (not underlined in the original 
text). Looked at in particular together with the Directive’s Recitals 56 and 57 and 
the French and English wording 2 it becomes evident that Article 25 should not be 
read as a ‘permissive’ provision but as a ‘prohibition’. 3 4 In other words, only 
where an ‘adequate level of protection’ exists in the third country, may a 
transfer of personal data be permitted from Member States (in general). 
Otherwise the transfer should be prohibited. 4 The relevant criteria for assessing 


1 - Directive of the European Parliament and of the Council of 24 October 1995 on the 

protection of individuals with regard to the processing of personal data and on the free 
movement of such data, OJ L 281, 23/1 1/1995, p. 31. 

2 - The French or English wording of Article 25(1) of Directive 95/46/EC read as follows: ‘Les 

Etats membres prevoient que le transfert vers un pays tiers de donnees a caractere 
personnel faisant I'objet d'un traitement, on destinees a faire I'objet d'un traitement apres 
leur transfert, ne peut avoir lieu que si, sous reserve du respect des dispositions nationales 
prises en application des autres dispositions de la presente directive, le pays tiers en 
question assure un niveau de protection adequat. ’ ‘The Member States shall provide that 
the transfer to a third country of personal data which are undergoing processing or are 
intended for processing after transfer may take place only if, without prejudice to 
compliance with the national provisions adopted pursuant to the other provisions of this 
Directive, the third country in question ensures an adequate level of protection. emphasis 
added. 

- Cf. on point Dammann/Simitis, EG-Datenschutzrichtlinie, Kommentar (1997), paragraph 4 
on Article 25 

4 - Cf. ECJ Case C- 101/01, paragraph 64. See also Ehmann/Helfrich, EG- 

Datenschutzrichtlinie. Kurzkommentar (1999), paragraphs 1 1 and 20 on Article 25. 
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the existence or absence of such ‘adequate level of protection’ are set out in 
Article 25(2) of the Directive. The Member States and Commission are to inform 
each other of cases where they consider that a third country does not demonstrate 
an ‘adequate level of protection’ (cf. Article 25(3)). 

3 In order to remove a burden from Member States when determining the relevant 
level of protection in the sense of interest here and to harmonise assessment in that 
regard by the Member States, Article 25 of the Directive enables the Commission 
to assess the level of data protection offered in a particular third country, on the 
basis of a committee composed of the representatives of the Member States under 
Article 3 1 of the Directive. 

4 Where the Commission finds, under Article 25(4) in conjunction with 
Article 31(2) of the Directive, that a particular third country does not demonstrate 
an adequate level of protection within the meaning of Article 25(2), the Member 
States are to take the measures necessary to prevent any transfer of data of 
the same type to the third country in question. From the wording of Article 25(4) 
in conjunction with Recital 57 it follows that any such finding is binding on the 
Member States or their supervisory authorities within the meaning of Article 28 of 
the Directive. Specifically, this means there is an obligation to prohibit data 
transfers to the relevant third country. 5 In addition, a ‘negative finding’ by the 
Commission based on Article 25(4) may also be restricted only to a specific 
processing sector, a field or specific modes of transfer of this third country. This 
follows from the reference in Article 25(4) to the assessment criteria in 
Article 25(2) of the Directive. 6 

5 Under Article 25(6) in conjunction with Article 32(2) of the Directive, the 
Commission may also find that a particular third country or a specific sector, field 
etc. 7 of it demonstrates an adequate level of protection within the meaning of 
Article 25(2) leg. cit. (‘positive decision’). In that case ‘the Member States shall 
take the measures necessary to comply with the Commission’s decision’ (cf. 
Article 25(6) Sentence 2). The fact that the Commission finds that there is an 
adequate level of data protection does not mean there is an obligation under EU 
law on the Member States to adopt a specific measure such as the (unconditional) 
approval of data transfers to the relevant third country. This follows from the 
formulation of the legal consequence, which clearly differs from Article 25(4) of 
the Directive (‘negative decision’). 8 A positive decision under Article 25(6) of the 


5 - See ECJ Case C- 10 1/0 1 , paragraph 69, and Dammann/Simitis, EG-Datenschutzrichtlinie. 
Kommentar ( 1 997), paragraphs 20 and 30 on Article 25. 

6 — See Dammann/Simitis, EG-Datenschutzrichtlinie. Kommentar (1997), paragraph 20 on 
Article 25. 

7 — See Article 25(6) Sentence 1 in conjunction with Article 25(2), second half of the sentence, 
of Directive 95/46/EC. 

- See Dammann/Simitis, EG-Datenschutzrichtlinie. Kommentar (1997), paragraphs 27 and 30 
on Article 25. For a contrary opinion see Ehmann/Helfrich, EG-Datenschutzrichtlinie. 
Kurzkommentar ( 1 999), paragraph 24 on Article 25 — admittedly before the first adequacy 
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Directive merely makes it clear that the level of protection in the relevant third 
country does not pose an obstacle to the transfer of data. In other words, positive 
decisions by the Commission certainly have the effect of harmonising the 
assessment by Member States of the adequacy of the data protection level in a 
third country but cannot be treated as amounting to a comprehensive 
standardisation of the practice of data transfer to and from third countries. 
Specifically, transfer restrictions may arise on grounds unrelated to data 
protection — such as ‘reservations’ or restrictions by individual states on 
constitutional or human rights grounds. 


2. The binding effect of Commission Decision 2000/520/EC of 26 July 2000, 
based on Article 25(6), in relation to the ‘safe harbour’ in particular 

6 Put simply, the Commission Decision of 26 July 2000 (2000/520/EC) based on 
Article 25(6) and (2) of the Directive 9 (‘the Decision’) established the adequacy 
of the level of data protection in relation to specific organisations in specific 
sectors of the US economy. In order to take advantage of the ‘positive effect’ of 
this adequacy decision, a US organisation in the sector under consideration must 
1. unambiguously and publicly commit to comply with the ‘safe harbour’ privacy 
principles (‘the Principles’) implemented under the guidelines included in the 
frequently asked questions (‘FAQs’) issued by the US Department of Commerce 
on 21 July 2000, 2. be subject to the supervision of the Federal Trade Commission 
and 3. have actually implemented the Principles in line with the quoted 
guidelines. 10 

7 Under Article 1(3) of the Decision (2000/520/EC) the existence of these 
requirements is considered to be met from the date on which the relevant US 
organisation notifies to the US Department of Commerce the public disclosure of 
the commitment and the identity of the responsible US supervisory authority. 

8 The presumption — laid down in Article 1(3) of the Decision — that an 
appropriate level of data protection is ensured in relation to data processing by 
specific US organisations is admittedly rebuttable. This is clear from the wording 
of Article 3(1) in conjunction with Recital 8 of this Decision. Under 
Article 3(l)(b) of the Decision the ‘competent authorities in the Member States’, 
i.e. the supervisory authorities within the meaning of Article 28 of the Directive, 
may indeed exercise ‘their existing powers to suspend data flows to an 

decisions were published by the Commission on the basis of Article 25(6) of Directive 
95/46/EC. 

9 — Commission Decision of 26 July 2000 (2000/520/EC) pursuant to Directive 95/46/EC of 

the European Parliament and of the Council on the adequacy of the protection provided by 
the safe harbour privacy principles and related frequently asked questions issued by the US 
Department of Commerce (notified under document number C(2000) 2441) OJ L 215 
25.8.2000, p. 7 — 47. 

10 — See Article 1(2) and (1) in conjunction with Annexes I -VII to Commission Decision of 

26 July 2000 (2000/520/EC). 
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organisation that has self-certified its adherence to the Principles implemented in 
accordance with the FAQs in order to protect individuals with regard to the 
processing of their personal data if . . . (b) there is a substantial likelihood that 
the Principles are being violated The suspension should end as soon as it is 
established that the Principles implemented according to the FAQs are being 
followed and the competent authorities in the European Union have been made 
aware of this. 11 

9 This approach of the rebuttable presumption along with the option of a temporary 
ban on data transfer to a third country that has, by a decision under Article 25(6) 
of the Directive, in principle been recognised as providing an adequate protection 
has been adopted by the Commission not just in the Decision (2000/520/EC) that 
is primarily of interest here but in a whole series of further adequacy decisions. 12 

10 It follows from what has been said above that the Commission itself in any event 
does not assume that an adequacy decision under Article 25(6) in conjunction with 
Article 25(2) of the Directive necessarily always has quasi- absolute binding 
effect on the supervisory authorities within the meaning of Article 28 of the 
Directive. Rather, the specific drafting of the adequacy decisions shows that the 
supervisory authorities still have a certain latitude (through the temporary 
suspension of data transfers) to combat violations of the conditions that in fact 
need to be met for there to be any assumption of adequacy. In order to be able to 
find such violations, the supervisory authorities must of course have the 
appropriate powers. 

1 1 Given the formulation of the question referred (‘no meaningful protection of those 
affected in the law and practice of a third country’) it might be questionable 
whether the powers under Article 3(1 )(b) of Decision 2000/520/EC accruing to 
the supervisory authorities within the meaning of Article 28 of the Directive are 
extensive enough to prevent the transfer of data if the focus is not solely on a US 
organisation’s violation of the ‘safe harbour’ Principles but rather reference is 
made to the level of protection to be ensured through the ‘safe harbour’ concept 
and practice as a whole. 

1 1 - See Article 3(1) and (2) of Commission Decision (2000/520/EC). 

12 - For example, see, Article 3(1) of Commission Decision (2000/518/EC) of 26 July 2000 

under Directive 95/46/EC of the European Parliament and of the Council on the adequacy 
of the protection of personal data in Switzerland, OJ L 215 of 25.8.2000, p. 1 — 3; 
Article 3(1) of Commission Decision of 21.11.2003 (2003/821/EC) on the adequacy of 
protection of personal data in Guernsey, OJ L 308 of 25.1 1.2003, p. 27 — 28; Article 3(1) 
of the Commission Decision of 28 April 2004 on the adequate protection of personal data in 
the Isle of Man (2004/41 1/EC), OJ L 151 of 30.4.2004, p. 51 — 54; Article 3(1) of the 
Commission Decision of 14 May 2004 on the adequate protection of personal data 
contained in the Passenger Name Record of air passengers transferred to the United States’ 
Bureau of Customs and Border Protection (2004/535/EC), OJ L 235 of 6.7.2004, p. 11 — 
22; Article 3(1) of the Commission Decision of 6 September 2005 on the adequate 
protection of personal data contained in the Passenger Name Record of air passengers 
transferred to the Canada Border Services Agency (2006/253/EC), OJ L 91 of 29.3.2006, 
p. 49 — 60. 
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12 The national court seems to view the possibility — provided in Article 3(l)(b) of 
the Decision — of banning data transfers as being restricted to those cases in 
which the US organisation regarded as the recipient of the transfers acts in 
violation of the ‘safe harbour’ Principles. 13 

13 Such an approach would be reasonable if the ‘safe harbour’ Principles only bound 
US organisations that voluntarily agree to be bound by these rules by way of a 
notification under Article 1(3) of the Decision. At first sight, the wording of 
Article 1(2) and (3) and Article 3(l)(a) of the Decision points in that direction in 
that it primarily refers to the voluntary commitment by the US organisations to 
implement the Principles or any negative findings by the US supervisory 
authorities in this respect. In addition, the Principles contained in Annex I to the 
Decision themselves refer to the fact that they ‘are intended for use solely by 
U.S. organizations receiving personal data from the European Union for the 
purpose of qualifying for the safe harbor and the presumption of “adequacy” it 
creates.’ 14 

14 However, a closer examination reveals that the ‘safe harbour’ Principles are 
binding not just on US organisations but also certain US authorities; specifically, 
those appointed to supervise compliance with the Principles by US organisations 
that have voluntarily committed to comply with them (FTC, US Department of 
Transportation). From the power of these supervisory authorities anchored in 
Article 3(l)(a) of Decision 2000/520/EC to determine violations of the Principles 
a simultaneous obligation arises to continually monitor the practices of the US 
organisations that ‘drop anchor’ ‘in the safe harbour’. This becomes clear through 
the case of the suspension of data transfers by a supervisory authority within the 
meaning of Article 28 of the Directive, addressed in Article 3(1 )(b) of the 
Decision, ‘if there is a reasonable basis for believing that the enforcement 
mechanism concerned is not taking or will not take adequate and timely steps to 
settle the case at issue . . . ’. 

15 Overall this demonstrates that the presumption of an adequate level of protection 
laid down by the Decision relies not only on faith in the integrity of the US 
organisations that commit to implement the ‘safe harbour’ Principles but also on 
faith in the effective supervision or implementation by the relevant US 
authorities. 

16 In addition to the aforementioned supervisory authorities, other US government 
bodies are also indirectly affected by the ‘safe harbour’ Principles. Indeed, the 
Principles state among other things that their ‘adherence may be limited (a) to the 
extent necessary to meet national security, public interest, or law enforcement 
requirements; (b) by statute, government regulation, or case law that create 
conflicting obligations or explicit authorizations, provided that, in exercising any 
such authorization, an organization can demonstrate that its non-compliance with 

- See Paragraph 19 of the Irish High Court’s request for a preliminary ruling. 

14 — See Annex I Paragraph 2 Sentence 3 to the Commission Decision (2000/520/EC). 
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the Principles is limited to the extent necessary to meet the overriding 
legitimate interests furthered by such authorization; or (c) if the effect of the 
Directive [or] Member State law is to allow exceptions or derogations, provided 
such exceptions or derogations are applied in comparable contexts.’. 

17 It follows from what has been said in the previous paragraph that, on the part of 
the US, compliance with the ‘safe harbour’ Principles may certainly be limited by 
contrary provisions for reasons, for example, of ‘national security’ without this 
amounting to a violation of the Principles per se. However, one might safely 
assume, against the background of the Commission’s commitment to the 
fundamental rights already in existence at the time the Decision was being 
‘worked out’ or adopted by the EU, in particular to Article 8 of the European 
Convention on Human Rights (see Article 6(1) and (3) of the ECHR in the Treaty 
of Amsterdam version), and from the understanding that underlies the Decision as 
a whole that the Member States of the European Union are able to rely in 
particular on the fact that if the national security ‘exception’ is relied upon this 
will not be to an extent that is unreasonable. From this perspective the Decision 
2000/520/EC also incorporates into legislation a rebuttable belief on the part of 
the Members States or their supervisory authorities under Article 28 of the 
Directive that the US government will adopt a constructive and moderate 
administrative approach as a whole to the extent substantive references arise to the 
‘safe harbour’ Principles. 

18 This understanding of the ‘safe harbour’ Principles incidentally is also confirmed 
by the Commission’s Communication of 27 November 2013 on the Functioning 
of the Safe Harbour ..., 15 which, taking into account the above exceptions for the 
benefit of national security or of the public interest, expressly provides that ‘in 
order for limitations and restrictions on the enjoyment of fundamental rights to 
be valid, they must be narrowly construed; they must be set forth in a publicly 
accessible law and they must be necessary and proportionate in a democratic 
society.’ 16 

19 To summarise, it can thus be concluded here that the power — arising under 
Article 3(1) of the Decision — of the supervisory authorities within the meaning 
of Article 28 of the Directive relates not just to violations of the ‘safe harbour’ 
Principles of which individual US organisations may be accused but clearly 
extends further and also includes modes of behaviour implemented by the US 
authorities and which undermine or could undermine these Principles. 


15 


16 


See Communication COM (2013) 847 final of the European Commission of 27 November 
2013 to the European Parliament and the Council on the Functioning of the Safe Flarbour 
from the Perspective of EU Citizens and Companies Established in the EU. 

See ibid. p. 18. 
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3. The question of the restriction of the discretion of supervisory authorities 
within the meaning of Article 28 of the Directive by Articles 7 and 8 of the EU 
Charter of Fundamental Rights (‘Charter’) in implementing Article 3 of the 
Commission’s Decision of 26 July 2000 relating to ‘safe harbour’. 

20 Under the Court’s established case law the Member States do not just have to 
interpret their national law in compliance with EU law but also to interpret 
secondary EU legislation so as to avoid clashes with the fundamental rights 
protected by EU legislation or with the other general principles of EU law. 17 

21 In the present case the central rule of secondary law in Article 25(6) of the 
Directive itself expressly states that Commission Decisions based on it are to 
ensure an adequate level of ‘protection of the private lives and basic freedoms 
and rights of individuals’. 

22 Hence there is no doubt that the authorisation in Article 3(1) of the Decision 
2000/520/EC, which provision is based on Article 25(6) of the Directive, should 
also be construed in the light of Articles 7 and 8 of the Charter. 

23 In this context a look at the Court’s interpretation, in Joined Cases C-411/10 and 
C -493/10, of Article 3(2) of Regulation (EC) No 343/2003 18 (since replaced by 
Article 17(1) of Regulation (EU) No 604/2013 of 26 June 2013) 19 is of particular 
interest. Under this provision each Member State was able to examine the content 
of an application by a citizen of a third country for asylum even if, under the 
Regulation’s responsibility criteria (Art. 5 et seq. leg. cit.), 20 it was not 
necessarily responsible. 

24 Fundamentally, the system of allocating responsibility created by the above 
Regulation rested on the principle of mutual trust, and specifically on asylum 
seekers experiencing treatment in each individual EU Member State that is 
consistent with the requirements of the Charter of Fundamental Rights and the 
Geneva Convention on Refugees. 21 In this context reference should have 


17 - See ECJ Case C-101/01, paragraph 87; Case C-305/05, paragraph 28; Joined Cases 

C-411/10 and C-493/10, paragraph 77. 

18 - Council Regulation (EC) No 343/2003 of 18 February 2003 establishing the criteria and 

mechanisms for determining the Member State responsible for examining an asylum 
application lodged in one of the Member States by a third-country national, OJ L 50 of 
25.2.2003, p. 1 — 10. 

19 - Regulation (EU) No 604/2013 of the European Parliament and of the Council of 26 June 

2013 establishing the criteria and mechanisms for determining the Member State 
responsible for examining an application for international protection lodged in one of the 
Member States by a third-country national or a stateless person, OJ L 180 of 29.6.2013, 
p. 31 — 59. 

20 - Now Articles 7 et seq. of Regulation (EU) No 604/2013. 

21 - See Joined Cases C-411/10 and C-493/10, paragraphs 78-80; also Case C-4/11, 

paragraph 54; Case C-394/12, paragraph 52. 
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been/should be made to relevant specific EU-law minimum standards for the 
treatment of asylum seekers. 22 

25 In this context it appeared legitimate, in order to avoid repeat proceedings in 
relation to one and the same asylum application, to concentrate the proceedings in 
the Member State identified using the responsibility criteria from Council 
Regulation (EC) No 343/2003 and to establish a corresponding transfer or 
acceptance obligation in relation to asylum seekers who had already made their 
application in a different Member State. 23 In Joined Cases C-411/10 and 
C-493/10 the Court held that a transfer to the EU Member State with 
responsibility for conducting the asylum proceedings would be incompatible with 
Article 4 of the Charter (Prohibition of torture and inhuman or degrading 
treatment or punishment) if ‘there are substantial grounds for believing that there 
are systemic flaws in the asylum procedure and reception conditions for asylum 
applicants in the Member State responsible, resulting in inhuman or degrading 
treatment, within the meaning of Article 4 of the Charter, of asylum seekers 
transferred to the territory of that Member State’. 24 In such a case the ‘may’ of 
Article 3(2) of Regulation (EC) No 343/2003 becomes, in the Court’s 
interpretation, a ‘must’. 

26 The Court’s reasoning described above can also be applied to the provision in 
Article 3(1) of Decision 2000/520/EC that is of interest here. So that this provision 
can effectively carry out its intended function to protect, in particular the 
fundamental right of data protection (Article 8 of the Charter), it is essential that 
actual violations of the ‘safe harbour’ Principles of which the authorities actually 
become aware are immediately addressed and, where necessary, responded to with 
a temporary suspension of data transfers. Hence Article 3(1) of Decision 
2000/520/EC should be read as meaning that where one of the situations in 
Article 3(1 )(a) or (b) of the Decision applies the supervisory authorities within the 
meaning of Article 28 of the Directive must exercise their powers to protect 
individuals with regard to the processing of their personal data for the protection 
of Article 8 of the Charter and must take appropriate action. 

22 

- See in particular Council Directive 2003/9/EC of 27 January 2003 laying down minimum 
standards for the reception of asylum seekers in the Member States, OJ L 31 of 6.2.2003, 
p. 8 — 15; Council Directive 2004/83/EC of 29 April 2004 on minimum standards for the 
qualification and status of third country nationals or stateless persons as refugees or as 
persons who otherwise need international protection and the content of the protection 
granted, OJ L 304 of 30.9.2004, p. 12 — 23, since replaced by Directive 201 1/95/EU of the 
European Parliament and of the Council of 1 3 December 2011 on standards for the 
qualification of third-country nationals or stateless persons as beneficiaries of international 
protection, for a uniform status for refugees or for persons eligible for subsidiary protection, 
and for the content of the protection granted, OJ L 337 of 20.12.201 1, p. 9 — 26, as well as 
Council Directive 2005/85/EC of 1 December 2005 on minimum standards on procedures 
in Member States for granting and withdrawing refugee status, OJ L 326 of 13.12.2005, 
p. 13 — 34. 

23 - See Paragraphs 16 et seq. of Regulation (EC) No 343/2003 or (now) Articles 18 et seq. of 

Regulation (EU) No 604/2013 of 26 June 2013. 

24 - See ECJ Joined Cases C-411/10 and C-493/10, paragraph 86. 
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III - Proposed response to the questions referred 

27 On the basis of the above considerations the Republic of Austria proposes the 
following response to the questions referred by the High Court of Ireland: 

‘In the course of determining a complaint which has been made to an 
independent office holder who has been vested by statute with the functions 
of administering and enforcing data protection legislation that personal data 
is being transferred to another third country (in this case, the United States 
of America), the laws and practices of which, it is claimed, do not contain 
adequate protections for the data subject, that office holder may and must 
exercise its powers and take appropriate steps with regard to Article 25(6) of 
Directive 95/46/EC, European Commission Decision 2000/520/EC of 26 July 
2000 relating to “safe harbour” and Article 7, Article 8 and Article 47 of the 
Charter of Fundamental Rights of the European Union, particularly in the 
light of factual developments in the meantime since that Commission 
Decision was first published.’ 

Vienna, 6 November 2014 
On behalf of the Republic of Austria: 

SC Dr Gerhard HESSE 
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